ALSA-2021:4647 — Important: kernel security update

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Insufficient validation of user-supplied sizes for the MSG_CRYPTO message type (CVE-2021-43267)

* kernel: timer tree corruption leads to missing wakeup and system freeze (CVE-2021-20317)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

Release	Package	Fixed in
AlmaLinux · 8	kernel-tools-libs-devel	4.18.0-348.2.1.el8_5

Vulnerabilities 2

Unscored —

CVE-2021-20317

A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 27, 2021
Unscored —

CVE-2021-43267 Public exploit EPSS 58%

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communic…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Nov 2, 2021

References

report
https://vulners.com/cve/CVE-2021-20317
report
https://vulners.com/cve/CVE-2021-43267

Important: kernel security update

Summary

Fixed packages 1

Vulnerabilities 2

A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add…

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communic…

References